A hands-on walkthrough of running an authenticated (credentialed) vulnerability scan against a Windows Server lab target using Tenable Nessus Essentials.
This project demonstrates the difference authenticated scanning makes in vulnerability management. Unauthenticated scans only see what's exposed externally — open ports, banners, and network-visible services. A credentialed scan logs into the target using valid credentials and inspects the system from the inside, surfacing missing patches, misconfigurations, and registry-level weaknesses that an external scan would miss entirely.
| Component | Detail |
|---|---|
| Target host | MUS-DC-01 (Windows Server 2022 Datacenter, Hyper-V VM) |
| Target IP | 192.168.1.2 |
| Scanner | Tenable Nessus Essentials |
| Scan type | Credentialed / Basic Network Scan |
| Auth method | Windows (domain credentials) |
All testing was performed against a system I own and control, in an isolated home lab environment. No production or third-party systems were scanned.
-
Confirm target connectivity — verified the target VM's IP configuration via
ipconfigbefore scanning.
-
Set up the scan in Nessus — reviewed existing scans in the "My Scans" dashboard.
-
Select a scan template — chose from the Vulnerabilities template category, using Basic Network Scan / Credential Validation as the foundation for an authenticated scan.
-
Configure scan settings — named the scan, added a description, and set the target IP.
-
Add Windows credentials — configured domain authentication (Password method) so Nessus could log into the target directly rather than scanning blind from the outside.
-
Review plugin families — Nessus ships with plugin checks organized by OS/technology family (Windows, AIX, Amazon Linux, CGI abuses, etc.), letting you scope which checks run.
-
Run the scan and review results — the completed scan authenticated successfully (
Auth: Pass) and identified 55 total findings across severity levels.
-
Drill into host-level vulnerabilities — reviewed the full findings list for the target, sorted by severity.
-
Analyze a specific finding — inspected a High-severity finding in detail: CVE-2013-3900 (WinVerifyTrust Signature Validation / EnableCertPaddingCheck), including description, remediation guidance, and risk scoring (CVSS 8.8, VPR 9.5).
| Field | Value |
|---|---|
| Severity | High |
| CVSS v3 | 8.8 |
| VPR (Vulnerability Priority Rating) | 9.5 |
| EPSS | 0.4465 |
| Plugin ID | 166555 |
Issue: Missing or misconfigured EnableCertPaddingCheck registry key, which leaves the system vulnerable to a WinVerifyTrust signature validation bypass. An unauthenticated remote attacker could exploit this to execute arbitrary code via specially crafted requests.
Remediation: Add and enable the EnableCertPaddingCheck registry value under:
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Wintrust\ConfigHKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Cryptography\Wintrust\Config(64-bit systems)
This is a good example of a finding that would never surface in an unauthenticated scan — it requires registry-level visibility only a credentialed scan provides.
This lab reflects the same real-world workflow behind vulnerability management inside a NIST RMF/POA&M process:
- Authenticated scan identifies a weakness
- Finding gets a severity rating and risk score (CVSS/VPR/EPSS)
- In a live environment, this finding would generate a POA&M entry with a remediation deadline based on severity (High = 30 days, Moderate = 90, Low = 180)
- Remediation guidance is applied and the fix is validated in a follow-up scan
- Tenable Nessus Essentials
- Windows Server 2022 (Hyper-V VM)
- Windows Command Prompt (
ipconfig)
This project was conducted entirely within a personal, isolated lab environment against a system I own. It is intended for educational and portfolio purposes. Always obtain explicit authorization before scanning any system you do not own or control.